CVE-2026-67449: Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key
Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/masterkey.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Portabaseto a version that resolves this vulnerability.Fixed in 1.21.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Portabase versions prior to 1.21.2 are affected if the TUS upload webhook handler is reachable. The issue can overwrite files under the private data directory, including the AES-256-GCM master key file.
Does exploitation require authentication or user interaction?
No. The vulnerability is described as unauthenticated, with network attack vector, low attack complexity, and no user interaction required.
What should teams do to remediate this issue?
Upgrade Portabase to version 1.21.2, which patches the vulnerable TUS webhook handler.
How can teams determine whether they may already be affected?
Investigate whether arbitrary files under the Portabase private data directory, particularly /data/private/keys/master_key.bin, may have been overwritten. The provided information does not specify indicators of compromise or a reliable detection method.